@memberjunction/react-runtime 5.51.0 → 5.51.1

package/.turbo/turbo-build.log

@@ -1,25 +1,25 @@
 
-> @memberjunction/react-runtime@5.51.0 build
+> @memberjunction/react-runtime@5.51.1 build
 > npm run build:node && npm run build:umd
 
 
-> @memberjunction/react-runtime@5.51.0 build:node
+> @memberjunction/react-runtime@5.51.1 build:node
 > tsc && tsc-alias -f
 
 
-> @memberjunction/react-runtime@5.51.0 build:umd
+> @memberjunction/react-runtime@5.51.1 build:umd
 > webpack --config webpack.umd.config.cjs
 
-Browserslist: browsers data (caniuse-lite) is 6 months old. Please run:
+Browserslist: browsers data (caniuse-lite) is 7 months old. Please run:
   npx update-browserslist-db@latest
   Why you should do it regularly: https://github.com/browserslist/update-db#readme
 [BABEL] Note: The code generator has deoptimised the styling of /home/runner/work/MJ/MJ/packages/MJCoreEntities/dist/generated/entity_subclasses.js as it exceeds the max of 500KB.
-asset runtime.umd.js 8.78 MiB [compared for emit] [big] (name: main)
+asset runtime.umd.js 8.79 MiB [compared for emit] [big] (name: main)
 asset 324.runtime.umd.js 218 KiB [compared for emit]
 asset 490.runtime.umd.js 182 KiB [compared for emit] (id hint: vendors)
 orphan modules 8.77 MiB [orphan] 571 modules
 runtime modules 6.94 KiB 10 modules
-cacheable modules 8.91 MiB
+cacheable modules 8.92 MiB
   modules by path ../../../node_modules/ 781 KiB
     modules by path ../../../node_modules/rxjs/dist/esm5/internal/ 30.4 KiB 16 modules
     modules by path ../../../node_modules/debug/src/*.js 12.7 KiB 2 modules
@@ -29,6 +29,6 @@ cacheable modules 8.91 MiB
     ../../MJCoreEntities/dist/engines/UserViewEngine.js 19.6 KiB [built] [code generated]
   ./dist/index.js + 29 modules 440 KiB [built] [code generated]
   ../../MJCore/dist/index.js + 88 modules 1.8 MiB [built] [code generated]
-  ../../MJGlobal/dist/index.js + 24 modules 312 KiB [built] [code generated]
+  ../../MJGlobal/dist/index.js + 24 modules 316 KiB [built] [code generated]
   ../../GraphQLDataProvider/dist/index.mjs 194 KiB [built] [code generated]
-webpack 5.105.0 compiled successfully in 70217 ms
+webpack 5.105.0 compiled successfully in 70131 ms

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @memberjunction/react-runtime
 
+## 5.51.1
+
+### Patch Changes
+
+- Updated dependencies [cc6f321]
+- Updated dependencies [e10a71f]
+  - @memberjunction/global@5.51.1
+  - @memberjunction/core@5.51.1
+  - @memberjunction/graphql-dataprovider@5.51.1
+  - @memberjunction/core-entities@5.51.1
+  - @memberjunction/interactive-component-types@5.51.1
+
 ## 5.51.0
 
 ### Patch Changes

package/dist/324.runtime.umd.js

@@ -361,7 +361,7 @@ var se=Object.defineProperty;var d=(g,e)=>se(g,"name",{value:e,configurable:!0})
                         }
                     }
                 }
-            `,r={entityDocumentID:e.entityDocumentID};e.maxRecords!==void 0&&(r.maxRecords=e.maxRecords),e.filter!==void 0&&(r.filter=e.filter);const s=await this._dataProvider.ExecuteGQL(t,r);if(!s?.FetchEntityVectors)throw new Error("Invalid response from server");return s.FetchEntityVectors}catch(t){const r=t;return (0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogError */ .ZI8)("GraphQLAIClient.FetchEntityVectors failed",void 0,r),{Success:!1,Results:[],TotalCount:0,ElapsedMs:0,ErrorMessage:r.message||"Unknown error"}}}}const F="5.51.0",$="default";class X{static{d(this,"BrowserStorageProviderBase")}constructor(){this._storage=new Map}getCategoryMap(e){const t=e||$;let r=this._storage.get(t);return r||(r=new Map,this._storage.set(t,r)),r}async GetItem(e,t){const s=this.getCategoryMap(t||$).get(e);return s===void 0?null:s}async GetItems(e,t){const r=new Map;if(e.length===0)return r;const s=this.getCategoryMap(t||$);for(const n of new Set(e)){const a=s.get(n);r.set(n,a===void 0?null:a)}return r}async SetItem(e,t,r){this.getCategoryMap(r||$).set(e,t)}async Remove(e,t){this.getCategoryMap(t||$).delete(e)}async ClearCategory(e){const t=e||$;this._storage.delete(t)}async GetCategoryKeys(e){const t=this._storage.get(e||$);return t?Array.from(t.keys()):[]}}const $e="MJ_Metadata",Pe=0;function Me(){try{const g=F.split("."),e=parseInt(g[0],10),t=parseInt(g[1],10);if(!Number.isFinite(e)||!Number.isFinite(t))throw new Error(`Could not parse major.minor from version "${F}"`);return e*1e3+t+Pe}catch(g){return (0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:g,message:"Failed to derive IDB version from PACKAGE_VERSION; using fallback 99999"}),99999}}d(Me,"computeIdbVersion");const Ae=Me(),Y=["mj:default","mj:Metadata","mj:RunViewCache","mj:RunQueryCache","mj:DatasetCache"];class Z extends X{static{d(this,"BrowserIndexedDBStorageProvider")}constructor(){super(),this._dbReady=!1,this.dbPromise=(0,_tempfix_idb__WEBPACK_IMPORTED_MODULE_10__/* .openDB */ .P2)($e,Ae,{upgrade:d((e,t,r)=>{try{(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogStatus */ .b09)(`[IDBCache] Upgrading IndexedDB schema v${t} \u2192 v${r} (package ${F}). Dropping all stores; caches will repopulate on first use.`);for(const s of Array.from(e.objectStoreNames))e.deleteObjectStore(s);for(const s of Y)e.objectStoreNames.contains(s)||e.createObjectStore(s)}catch(s){(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:s,message:s?.message})}},"upgrade"),blocked:d((e,t)=>{(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogStatus */ .b09)(`[IDBCache] Upgrade from v${e} to v${t} blocked by another tab. Close other tabs to allow the upgrade to proceed.`)},"blocked")}),this.dbPromise.then(e=>{this._dbReady=!0,e.onversionchange=()=>{(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogStatus */ .b09)("[IDBCache] DB schema upgraded in another tab \u2014 closing local connection."),e.close(),this._dbReady=!1}}).catch(e=>{(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:e,message:"IndexedDB initialization failed: "+e?.message})})}get IsReady(){return this._dbReady}isKnownCategory(e){const t=`mj:${e}`;return Y.includes(t)}getStoreName(e){const t=e||$;return this.isKnownCategory(t)?`mj:${t}`:"mj:default"}getStoreKey(e,t){const r=t||$;return this.isKnownCategory(r)?e:`[${r}]:${e}`}async SetItem(e,t,r){try{const s=await this.dbPromise,n=this.getStoreName(r),a=this.getStoreKey(e,r),i=s.transaction(n,"readwrite");await i.objectStore(n).put(t,a),await i.done}catch(s){(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:s,message:s?.message})}}async GetItem(e,t){try{const r=await this.dbPromise,s=this.getStoreName(t),n=this.getStoreKey(e,t),a=await r.transaction(s).objectStore(s).get(n);return a===void 0?null:a}catch(r){return (0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:r,message:r?.message}),null}}async GetItems(e,t){const r=new Map;if(e.length===0)return r;try{const s=await this.dbPromise,n=this.getStoreName(t),a=Array.from(new Set(e)),i=a.map(f=>this.getStoreKey(f,t)),o=s.transaction(n,"readonly"),m=o.objectStore(n),u=i.map(f=>m.get(f)),h=await Promise.all(u);await o.done;for(let f=0;f<a.length;f++){const y=h[f];r.set(a[f],y===void 0?null:y)}return r}catch(s){(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:s,message:s?.message});for(const n of new Set(e))r.set(n,null);return r}}async Remove(e,t){try{const r=await this.dbPromise,s=this.getStoreName(t),n=this.getStoreKey(e,t),a=r.transaction(s,"readwrite");await a.objectStore(s).delete(n),await a.done}catch(r){(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:r,message:r?.message})}}async ClearCategory(e){try{const t=await this.dbPromise,r=e||$,s=this.getStoreName(e);if(this.isKnownCategory(r)){const n=t.transaction(s,"readwrite");await n.objectStore(s).clear(),await n.done}else{const n=`[${r}]:`,a=t.transaction("mj:default","readwrite"),i=a.objectStore("mj:default"),o=await i.getAllKeys();for(const m of o)typeof m=="string"&&m.startsWith(n)&&await i.delete(m);await a.done}}catch(t){(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:t,message:t?.message})}}async GetCategoryKeys(e){try{const t=await this.dbPromise,r=e||$,s=this.getStoreName(e),i=await t.transaction(s,"readonly").objectStore(s).getAllKeys();if(this.isKnownCategory(r))return i.map(m=>String(m));const o=`[${r}]:`;return i.map(m=>String(m)).filter(m=>m.startsWith(o)).map(m=>m.slice(o.length))}catch(t){return (0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:t,message:t?.message}),[]}}}const b=new A,Ne=(0,graphql_request__WEBPACK_IMPORTED_MODULE_0__/* .gql */ .J1)`subscription RemoteOperationProgress($channelId: ID!) {
+            `,r={entityDocumentID:e.entityDocumentID};e.maxRecords!==void 0&&(r.maxRecords=e.maxRecords),e.filter!==void 0&&(r.filter=e.filter);const s=await this._dataProvider.ExecuteGQL(t,r);if(!s?.FetchEntityVectors)throw new Error("Invalid response from server");return s.FetchEntityVectors}catch(t){const r=t;return (0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogError */ .ZI8)("GraphQLAIClient.FetchEntityVectors failed",void 0,r),{Success:!1,Results:[],TotalCount:0,ElapsedMs:0,ErrorMessage:r.message||"Unknown error"}}}}const F="5.51.1",$="default";class X{static{d(this,"BrowserStorageProviderBase")}constructor(){this._storage=new Map}getCategoryMap(e){const t=e||$;let r=this._storage.get(t);return r||(r=new Map,this._storage.set(t,r)),r}async GetItem(e,t){const s=this.getCategoryMap(t||$).get(e);return s===void 0?null:s}async GetItems(e,t){const r=new Map;if(e.length===0)return r;const s=this.getCategoryMap(t||$);for(const n of new Set(e)){const a=s.get(n);r.set(n,a===void 0?null:a)}return r}async SetItem(e,t,r){this.getCategoryMap(r||$).set(e,t)}async Remove(e,t){this.getCategoryMap(t||$).delete(e)}async ClearCategory(e){const t=e||$;this._storage.delete(t)}async GetCategoryKeys(e){const t=this._storage.get(e||$);return t?Array.from(t.keys()):[]}}const $e="MJ_Metadata",Pe=0;function Me(){try{const g=F.split("."),e=parseInt(g[0],10),t=parseInt(g[1],10);if(!Number.isFinite(e)||!Number.isFinite(t))throw new Error(`Could not parse major.minor from version "${F}"`);return e*1e3+t+Pe}catch(g){return (0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:g,message:"Failed to derive IDB version from PACKAGE_VERSION; using fallback 99999"}),99999}}d(Me,"computeIdbVersion");const Ae=Me(),Y=["mj:default","mj:Metadata","mj:RunViewCache","mj:RunQueryCache","mj:DatasetCache"];class Z extends X{static{d(this,"BrowserIndexedDBStorageProvider")}constructor(){super(),this._dbReady=!1,this.dbPromise=(0,_tempfix_idb__WEBPACK_IMPORTED_MODULE_10__/* .openDB */ .P2)($e,Ae,{upgrade:d((e,t,r)=>{try{(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogStatus */ .b09)(`[IDBCache] Upgrading IndexedDB schema v${t} \u2192 v${r} (package ${F}). Dropping all stores; caches will repopulate on first use.`);for(const s of Array.from(e.objectStoreNames))e.deleteObjectStore(s);for(const s of Y)e.objectStoreNames.contains(s)||e.createObjectStore(s)}catch(s){(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:s,message:s?.message})}},"upgrade"),blocked:d((e,t)=>{(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogStatus */ .b09)(`[IDBCache] Upgrade from v${e} to v${t} blocked by another tab. Close other tabs to allow the upgrade to proceed.`)},"blocked")}),this.dbPromise.then(e=>{this._dbReady=!0,e.onversionchange=()=>{(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogStatus */ .b09)("[IDBCache] DB schema upgraded in another tab \u2014 closing local connection."),e.close(),this._dbReady=!1}}).catch(e=>{(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:e,message:"IndexedDB initialization failed: "+e?.message})})}get IsReady(){return this._dbReady}isKnownCategory(e){const t=`mj:${e}`;return Y.includes(t)}getStoreName(e){const t=e||$;return this.isKnownCategory(t)?`mj:${t}`:"mj:default"}getStoreKey(e,t){const r=t||$;return this.isKnownCategory(r)?e:`[${r}]:${e}`}async SetItem(e,t,r){try{const s=await this.dbPromise,n=this.getStoreName(r),a=this.getStoreKey(e,r),i=s.transaction(n,"readwrite");await i.objectStore(n).put(t,a),await i.done}catch(s){(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:s,message:s?.message})}}async GetItem(e,t){try{const r=await this.dbPromise,s=this.getStoreName(t),n=this.getStoreKey(e,t),a=await r.transaction(s).objectStore(s).get(n);return a===void 0?null:a}catch(r){return (0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:r,message:r?.message}),null}}async GetItems(e,t){const r=new Map;if(e.length===0)return r;try{const s=await this.dbPromise,n=this.getStoreName(t),a=Array.from(new Set(e)),i=a.map(f=>this.getStoreKey(f,t)),o=s.transaction(n,"readonly"),m=o.objectStore(n),u=i.map(f=>m.get(f)),h=await Promise.all(u);await o.done;for(let f=0;f<a.length;f++){const y=h[f];r.set(a[f],y===void 0?null:y)}return r}catch(s){(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:s,message:s?.message});for(const n of new Set(e))r.set(n,null);return r}}async Remove(e,t){try{const r=await this.dbPromise,s=this.getStoreName(t),n=this.getStoreKey(e,t),a=r.transaction(s,"readwrite");await a.objectStore(s).delete(n),await a.done}catch(r){(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:r,message:r?.message})}}async ClearCategory(e){try{const t=await this.dbPromise,r=e||$,s=this.getStoreName(e);if(this.isKnownCategory(r)){const n=t.transaction(s,"readwrite");await n.objectStore(s).clear(),await n.done}else{const n=`[${r}]:`,a=t.transaction("mj:default","readwrite"),i=a.objectStore("mj:default"),o=await i.getAllKeys();for(const m of o)typeof m=="string"&&m.startsWith(n)&&await i.delete(m);await a.done}}catch(t){(0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:t,message:t?.message})}}async GetCategoryKeys(e){try{const t=await this.dbPromise,r=e||$,s=this.getStoreName(e),i=await t.transaction(s,"readonly").objectStore(s).getAllKeys();if(this.isKnownCategory(r))return i.map(m=>String(m));const o=`[${r}]:`;return i.map(m=>String(m)).filter(m=>m.startsWith(o)).map(m=>m.slice(o.length))}catch(t){return (0,_memberjunction_core__WEBPACK_IMPORTED_MODULE_1__/* .LogErrorEx */ .Q1A)({error:t,message:t?.message}),[]}}}const b=new A,Ne=(0,graphql_request__WEBPACK_IMPORTED_MODULE_0__/* .gql */ .J1)`subscription RemoteOperationProgress($channelId: ID!) {
     RemoteOperationProgress(channelId: $channelId) {
         ChannelId
         ProgressJSON

package/dist/runtime.umd.js

@@ -23018,8 +23018,9 @@ var RowLevelSecurityFilterInfo = /*#__PURE__*/function (_BaseInfo4) {
         for (var i = 0; i < keys.length; i++) {
           var key = keys[i];
           var val = user[key];
-          if (val !== null && securityInfo_typeof(val) !== 'object') {
-            ret = ret.replace(new RegExp("{{User".concat(key, "}}"), 'g'), String(val));
+          if (val !== null && val !== undefined && securityInfo_typeof(val) !== 'object') {
+            var safeVal = String(val).replace(/'/g, "''");
+            ret = ret.replace(new RegExp("{{User".concat(key, "}}"), 'g'), safeVal);
           }
         }
         // Per-session magic-link resource scope. Fail-closed: an absent scope resolves
@@ -55796,11 +55797,17 @@ var DatabaseProviderBase = /*#__PURE__*/function (_ProviderBase) {
   }, {
     key: "ValidateUserProvidedSQLClause",
     value: function ValidateUserProvidedSQLClause(clause) {
-      // Remove string literals to avoid false positives
-      var stringLiteralPattern = /(['"])(?:(?=(\\?))\2[\s\S])*?\1/g;
-      var clauseWithoutStrings = clause.replace(stringLiteralPattern, '');
+      // Remove string literals to avoid false positives.
+      //
+      // 🚨 SECURITY: this uses the SHARED stripper in @memberjunction/global. It must match how
+      // SQL Server / PostgreSQL actually parse literals — see StripSQLStringLiterals for the full
+      // rationale and the backslash-escape bypass it exists to prevent. Do NOT inline a regex here;
+      // an inline copy is exactly how this screen and SQLExpressionValidator drifted apart before.
+      var clauseWithoutStrings = (0,dist/* StripSQLStringLiterals */.SN)(clause);
       var lowerClause = clauseWithoutStrings.toLowerCase();
-      var forbiddenPatterns = [/\binsert\b/, /\bupdate\b/, /\bdelete\b/, /\bexec\b/, /\bexecute\b/, /\bdrop\b/, /--/, /\/\*/, /\*\//, /\bunion\b/, /\bxp_/, /;/];
+      var forbiddenPatterns = [/\binsert\b/, /\bupdate\b/, /\bdelete\b/, /\bexec\b/, /\bexecute\b/, /\bdrop\b/, /--/, /\/\*/, /\*\//, /\bunion\b/, /\bxp_/, /;/,
+      // Time-based blind injection vector — no legitimate filter/order-by clause uses WAITFOR.
+      /\bwaitfor\b/];
       for (var _i = 0, _forbiddenPatterns = forbiddenPatterns; _i < _forbiddenPatterns.length; _i++) {
         var pattern = _forbiddenPatterns[_i];
         if (pattern.test(lowerClause)) return false;
@@ -124267,6 +124274,7 @@ __webpack_require__.d(__webpack_exports__, {
   fK: () => (/* reexport */ RequiresSubclass),
   rH: () => (/* reexport */ SQLExpressionValidator),
   NG: () => (/* reexport */ SafeJSONParse),
+  SN: () => (/* reexport */ StripSQLStringLiterals),
   jd: () => (/* reexport */ UUIDsEqual),
   Om: () => (/* reexport */ ValidationErrorInfo),
   wX: () => (/* reexport */ ValidationErrorType),
@@ -124275,7 +124283,7 @@ __webpack_require__.d(__webpack_exports__, {
   gZ: () => (/* reexport */ uuidv4)
 });
 
-// UNUSED EXPORTS: ALLOWED_SQL_FUNCTIONS, BuildCronExpression, CRON_DAY_NAMES, ClassFactory, ClassIsOptionalKeyedSpecialization, ClassRegistration, ClassRequiresSubclass, CleanJSON, CleanJavaScript, ConvertMarkdownStringToHtmlList, CopyScalarsAndArrays, DANGEROUS_SQL_KEYWORDS, DEFAULT_RICH_TEXT_SCAN_LENGTH, DeepDiffer, DefaultCronSchedule, DeprecationWarningManager, DescribeCronExpression, DiffChangeType, ENCRYPTED_SENTINEL, EscapeHTML, FULL_QUERY_ALLOWED_KEYWORDS, FieldRulesEvaluator, FieldTransformEngine, FormatTimeOfDay, GetClassInheritance, GetClassName, GetFieldTransform, GetFullClassHierarchy, GetRootClass, GetSuperclass, HighlightSearchMatches, InvokeManualResize, IsClassConstructor, IsDescendantClassOf, IsEncryptedSentinel, IsOnlyTimezoneShift, IsPlausibleCronExpression, IsRootClass, IsSubclassOf, IsValidUUID, IsValueEncrypted, JSONValidator, KeyedSerialTaskQueue, MJEvent, MJGlobalProperty, OPTIONAL_KEYED_SPECIALIZATION_KEY, ObjectCache, ObjectCacheEntry, Ordinal, ParseCronExpression, ParseJSONRecursive, REQUIRES_SUBCLASS_KEY, RegisterClassEx, RegisterFieldTransform, SafeExpressionEvaluator, ShutdownRegistry, ToJSONSafe, adjustCasing, compareStringsByLine, convertCamelCaseToHaveSpaces, createDisplayName, defaultExpressionEvaluator, detectRichTextFormat, ensureRegExp, ensureRegExps, generatePluralName, getIrregularPlural, getValueAtPath, matchesAllPatterns, matchesAnyPattern, parsePattern, parsePatterns, replaceAllSpaces, resolveMappingRef, resolveValueMapping, stripTrailingChars, stripWhitespace
+// UNUSED EXPORTS: ALLOWED_SQL_FUNCTIONS, BLOCKED_SYSTEM_OBJECT_PATTERNS, BuildCronExpression, CRON_DAY_NAMES, ClassFactory, ClassIsOptionalKeyedSpecialization, ClassRegistration, ClassRequiresSubclass, CleanJSON, CleanJavaScript, ConvertMarkdownStringToHtmlList, CopyScalarsAndArrays, DANGEROUS_SQL_KEYWORDS, DEFAULT_RICH_TEXT_SCAN_LENGTH, DeepDiffer, DefaultCronSchedule, DeprecationWarningManager, DescribeCronExpression, DiffChangeType, ENCRYPTED_SENTINEL, EscapeHTML, FULL_QUERY_ALLOWED_KEYWORDS, FieldRulesEvaluator, FieldTransformEngine, FormatTimeOfDay, GetClassInheritance, GetClassName, GetFieldTransform, GetFullClassHierarchy, GetRootClass, GetSuperclass, HighlightSearchMatches, InvokeManualResize, IsClassConstructor, IsDescendantClassOf, IsEncryptedSentinel, IsOnlyTimezoneShift, IsPlausibleCronExpression, IsRootClass, IsSubclassOf, IsValidUUID, IsValueEncrypted, JSONValidator, KeyedSerialTaskQueue, MJEvent, MJGlobalProperty, OPTIONAL_KEYED_SPECIALIZATION_KEY, ObjectCache, ObjectCacheEntry, Ordinal, ParseCronExpression, ParseJSONRecursive, REQUIRES_SUBCLASS_KEY, RegisterClassEx, RegisterFieldTransform, SafeExpressionEvaluator, ShutdownRegistry, ToJSONSafe, adjustCasing, compareStringsByLine, convertCamelCaseToHaveSpaces, createDisplayName, defaultExpressionEvaluator, detectRichTextFormat, ensureRegExp, ensureRegExps, generatePluralName, getIrregularPlural, getValueAtPath, matchesAllPatterns, matchesAnyPattern, parsePattern, parsePatterns, replaceAllSpaces, resolveMappingRef, resolveValueMapping, stripTrailingChars, stripWhitespace
 
 ;// ../../MJGlobal/dist/ClassUtils.js
 /**
@@ -129136,6 +129144,63 @@ var FULL_QUERY_ALLOWED_KEYWORDS = [
 // standalone SELECT statement, so allowing FOR in full-query context is safe.
 // (FOR UPDATE remains blocked via the independent UPDATE keyword.)
 'FOR'];
+/**
+ * System catalog / metadata objects that must never be referenced from a user-supplied
+ * expression or ad-hoc query, in ANY context (including `full_query`). These sit outside
+ * MemberJunction's entity-permission model, so allowing them turns a validated SELECT into
+ * a schema-enumeration and credential-exfiltration primitive
+ * (e.g. `SELECT name, password_hash FROM sys.sql_logins`,
+ *  `SELECT * FROM INFORMATION_SCHEMA.COLUMNS`, `SELECT * FROM pg_catalog.pg_authid`).
+ * String literals are stripped before this check runs, so a literal value like `'sys.x'` is safe.
+ */
+var BLOCKED_SYSTEM_OBJECT_PATTERNS = [/\bSYS\s*\.\s*\w/i,
+// SQL Server system catalog schema: sys.sql_logins, sys.objects, sys.fn_*, ...
+/\bINFORMATION_SCHEMA\b/i,
+// ANSI catalog views — schema/table/column enumeration
+/\bSYSLOGINS\b/i,
+// legacy SQL Server logins view
+/\bPG_CATALOG\s*\./i,
+// PostgreSQL system catalog schema
+/\bPG_(AUTHID|SHADOW|USER|ROLES)\b/i // PostgreSQL credential / role catalogs
+];
+/**
+ * Matches SQL string literals the way SQL Server and PostgreSQL (with the default
+ * `standard_conforming_strings=on`) actually parse them: a literal is closed by the next
+ * single quote, `''` is an embedded quote, and a backslash is an ORDINARY character that
+ * does NOT escape the closing quote. Double-quoted runs are matched with the same doubling
+ * rule so a delimited identifier can't hide a payload either.
+ *
+ * @see StripSQLStringLiterals — use that, not this constant, so every caller gets the
+ * documented semantics and the two validators in MJ can never drift apart again.
+ */
+var SQL_STRING_LITERAL_PATTERN = /'(?:[^']|'')*'|"(?:[^"]|"")*"/g;
+/**
+ * Removes SQL string literals from a clause or expression so that a keyword denylist can be
+ * applied to the *code* portion without tripping over keywords that appear inside quoted data
+ * (e.g. `Comments LIKE '%--%'`).
+ *
+ * 🚨 SECURITY — this is the single implementation of literal-stripping for MJ's SQL screens, and
+ * it MUST stay byte-for-byte consistent with how the database parses literals. If the stripper
+ * removes a span the database does NOT treat as a literal, everything hidden inside that span
+ * bypasses the denylist while the database still executes it.
+ *
+ * An earlier version of this logic (duplicated in two places, which is how it survived) honored
+ * **backslash escaping** — `/(['"])(?:(?=(\\?))\2[\s\S])*?\1/g`. SQL Server and PostgreSQL do not
+ * treat `\` as an escape character, so `x = 'a\') ; DROP TABLE Users; --'` was swallowed whole as
+ * one "literal" and stripped to `x = `, which passed every denylist — while the database closed
+ * the literal at the real quote and executed the stacked statement.
+ *
+ * **Do NOT reintroduce backslash-escape handling here, and do NOT inline a second copy of this
+ * regex anywhere else — call this function.**
+ *
+ * @param sql The clause, expression, or query to strip literals from
+ * @returns The input with every complete string literal removed. An UNTERMINATED literal is left
+ *          in place on purpose: the stray quote and everything after it stay visible to the
+ *          denylist rather than being silently swallowed.
+ */
+function StripSQLStringLiterals(sql) {
+  return sql.replace(SQL_STRING_LITERAL_PATTERN, '');
+}
 /**
  * Safe SQL functions allowed in expressions, organized by category
  */
@@ -129241,14 +129306,14 @@ var SQLExpressionValidator = /*#__PURE__*/function (_BaseSingleton) {
     }
     /**
      * Remove string literals to avoid false positives in keyword detection.
-     * Handles both single and double quoted strings with escaped quotes.
+     *
+     * 🚨 SECURITY: delegates to {@link StripSQLStringLiterals} — read the warning there before
+     * changing anything about how literals are matched. This must never grow its own regex again.
      */
   }, {
     key: "removeStringLiterals",
     value: function removeStringLiterals(expression) {
-      // Match both single and double quoted strings, handling escaped quotes
-      var stringPattern = /(['"])(?:(?=(\\?))\2[\s\S])*?\1/g;
-      return expression.replace(stringPattern, '');
+      return StripSQLStringLiterals(expression);
     }
     /**
      * Check for dangerous SQL patterns that indicate injection attempts
@@ -129308,15 +129373,29 @@ var SQLExpressionValidator = /*#__PURE__*/function (_BaseSingleton) {
             };
           }
         }
-        // Check statement terminator (prevents multi-statement injection).
-        // For full_query context, strip comments first (a trailing semicolon may be followed by
-        // an inline comment like `ORDER BY x DESC; -- highest first`), then strip the trailing
-        // semicolon. Only reject if semicolons remain mid-statement, indicating injection.
+        // Block references to database system catalogs / metadata objects in ALL contexts
+        // (including full_query). These live outside MemberJunction's entity-permission model, so
+        // permitting them turns a validated SELECT into a schema-enumeration / credential-exfiltration
+        // primitive. String literals were already stripped upstream, so legitimate literal values are safe.
       } catch (err) {
         _iterator.e(err);
       } finally {
         _iterator.f();
       }
+      for (var _i = 0, _BLOCKED_SYSTEM_OBJEC = BLOCKED_SYSTEM_OBJECT_PATTERNS; _i < _BLOCKED_SYSTEM_OBJEC.length; _i++) {
+        var sysPattern = _BLOCKED_SYSTEM_OBJEC[_i];
+        if (sysPattern.test(textToCheck)) {
+          return {
+            valid: false,
+            error: 'Access to database system catalogs / metadata objects is not allowed',
+            trigger: 'system-object'
+          };
+        }
+      }
+      // Check statement terminator (prevents multi-statement injection).
+      // For full_query context, strip comments first (a trailing semicolon may be followed by
+      // an inline comment like `ORDER BY x DESC; -- highest first`), then strip the trailing
+      // semicolon. Only reject if semicolons remain mid-statement, indicating injection.
       var textForSemicolonCheck = isFullQuery ? this.stripSQLComments(expression).replace(/;\s*$/, '') // strip comments then trailing semicolon
       : expression;
       if (textForSemicolonCheck.includes(';')) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memberjunction/react-runtime",
-  "version": "5.51.0",
+  "version": "5.51.1",
   "description": "Platform-agnostic React component runtime for MemberJunction. Provides core compilation, registry, and execution capabilities for React components in any JavaScript environment.",
   "type": "module",
   "main": "dist/index.js",
@@ -29,11 +29,11 @@
   },
   "homepage": "https://github.com/MemberJunction/MJ#readme",
   "dependencies": {
-    "@memberjunction/core": "5.51.0",
-    "@memberjunction/global": "5.51.0",
-    "@memberjunction/interactive-component-types": "5.51.0",
-    "@memberjunction/core-entities": "5.51.0",
-    "@memberjunction/graphql-dataprovider": "5.51.0",
+    "@memberjunction/core": "5.51.1",
+    "@memberjunction/global": "5.51.1",
+    "@memberjunction/interactive-component-types": "5.51.1",
+    "@memberjunction/core-entities": "5.51.1",
+    "@memberjunction/graphql-dataprovider": "5.51.1",
     "@babel/standalone": "^7.29.1",
     "rxjs": "^7.8.2"
   },